One trick, even though it doesn't "lock it down" the same way, is to use a minimalist launcher. Check out OLauncher. It is a text-based launcher, it only has room for a few apps on the homepage, and it discourages fiddling with your phone.
https://github.com/tstromberg/quietude is how I manage my Pixel phone as well as my kids; I begin with “quietude.sh disable all”, but usually re-enable maps.
It takes a similar approach to the OP - changing restrictions requires a USB cable and a computer.
andoff[1] works well. I use it to lock down DNS settings to nextdns to block all the sites I want.
Then I use lockmeout[2] to lock opening andoff to change the settings.
Also there is limitphone[3], but it has less settings and is easier to uninstall than andoff, but works via the same mechanism.
https://github.com/tanujnotes/Olauncher?tab=readme-ov-file